Positive Technologies (dbugs)
| Product | Positive Technologies vulnerability database (dbugs) |
| Records still shown as active | 9, every withdrawn identifier against Open WebUI |
| First contacted | 2026-08-08 |
| Channels tried | dbugs@ |
| Status | Awaiting response |
Records
Every CVE withdrawn against Open WebUI still has a live dbugs entry, each with its own PT- identifier, a severity, a description of the defect and a recommendations section. Each identifier below is in the REJECTED state at cve.org and at NVD:
| Identifier | Withdrawn by | Rejected since | Our assessment |
|---|---|---|---|
| CVE-2024-7033 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7034 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7038 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7039 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7040 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7959 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2025-15603 | VulDB | 2026-06-18 | Disposition |
| CVE-2025-29446 | MITRE | 2026-06-29 | Disposition |
| CVE-2025-63391 | MITRE | 2026-06-29 | Disposition |
Two entries we can cite directly: PT-2026-24109 for CVE-2025-15603, and PT-2025-17455 for CVE-2025-29446.
The entries tell operators what to do about it
dbugs entries carry a Recommendations section. The advice is specific, actionable and attached to identifiers that no longer exist.
CVE-2025-29446 (PT-2025-17455, CVSS 3.1 rated 3.3 Low, last updated 2025-05-28) advises restricting access to the verify_connection() function in routers/ollama.py "until a patch is available", and suggests that disabling that function "may help minimize the risk of exploitation".
The identifier was withdrawn on 2026-06-29, so no patch is coming. An operator who follows that guidance disables working functionality and waits indefinitely, in response to a defect the issuing CNA has determined was never there.
CVE-2025-15603 (PT-2026-24109) similarly recommends upgrading to a version of Open WebUI later than 0.6.16 in order to remediate. That identifier was withdrawn on 2026-06-18.
Remediation guidance raises the cost of a stale record considerably. A wrong severity misinforms a reader. A wrong recommendation changes what they run.
The record travels further than the database
The dbugs entry for CVE-2025-29446 lists nine references. Alongside NVD and OSV, they include four Telegram channel posts and two Twitter posts announcing the CVE and one reference already marked Deleted.
Those are broadcast channels. A post announcing a CVE is not revised when the identifier is withdrawn, and each one is a copy that outlives the record it came from. A rejection at cve.org reaches none of them.
Contact log
| Date | Channel | Outcome |
|---|---|---|
| 2026-08-08 | dbugs@ | Awaiting response |
See also
- Rejected CVEs in Vulnerability Databases, the overview and how to verify any record yourself.
- Vendor Dispositions, our assessment of each identifier listed above.